Description

Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Remediation

References

https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1741

http://www.openwall.com/lists/oss-security/2020/03/25/2

Related Vulnerabilities

CVE-2010-2227 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2019-12397 Vulnerability in maven package org.apache.ranger:ranger

CVE-2023-49382 Vulnerability in maven package com.jfinal:jfinal

CVE-2019-10425 Vulnerability in maven package org.jvnet.hudson.plugins:gcal

CVE-2018-1000136 Vulnerability in npm package electron

Severity

Critical

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Mailing List Third Party Advisory